Detection rules › Sublime MQL
Attachment: OLE external relationship containing file scheme link to IP address
This rule identifies attachments containing file scheme links pointing to IP Addresses, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software. The rule negates firing on IP addresses governed by RFC1918 or privately allocated space.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_macros
or .file_extension in~ $file_extensions_common_archives
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
)
and any(file.oletools(.).relationships,
.target_url.scheme == "file"
and regex.contains(.target_url.path,
'([0-9]{2,3}\.){3}[0-9]{2,3}'
)
and not regex.icontains(.target_url.path,
'(10\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5]))|(172\.(?:1[6-9]|2\d|3[0-1])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5]))|(192\.168\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5]))'
)
)
)
and (
not profile.by_sender().any_messages_benign
or profile.by_sender().any_messages_malicious_or_spam
)
Detection logic
Scope: inbound message.
This rule identifies attachments containing file scheme links pointing to IP Addresses, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software. The rule negates firing on IP addresses governed by RFC1918 or privately allocated space.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_macros
- .file_extension in $file_extensions_common_archives
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .size < 100000000
any of
file.oletools(.).relationshipswhere all hold:- .target_url.scheme is 'file'
- .target_url.path matches '([0-9]{2,3}\\.){3}[0-9]{2,3}'
not:
- .target_url.path matches '(10\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5])\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5])\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5]))|(172\\.(?:1[6-9]|2\\d|3[0-1])\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5])\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5]))|(192\\.168\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5])\\.(?:\\d{1,2}|1\\d{2}|2[0-4]\\d|25[0-5]))'
any of:
not:
- profile.by_sender().any_messages_benign
- profile.by_sender().any_messages_malicious_or_spam
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.oletools, profile.by_sender, regex.contains, regex.icontains. Reference lists: $file_extensions_common_archives, $file_extensions_macros.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
file.oletools(attachments[]).relationships[].target_url.scheme | equals | file |
regex.contains | regex | ([0-9]{2,3}\.){3}[0-9]{2,3} |
regex.icontains | regex | (10\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5]))|(172\.(?:1[6-9]|2\d|3[0-1])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5]))|(192\.168\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])\.(?:\d{1,2}|1\d{2}|2[0-4]\d|25[0-5])) |